A consent management platform (CMP) displays cookie banners and preference centres on websites and apps, records visitors' choices and passes them on to analytics and advertising scripts, so that nothing loads without permission. Organisations use it to meet the consent rules of the GDPR and the ePrivacy rules, to be able to show who agreed to what, and to manage consent across several sites and languages. OneTrust is a well-known US reference point.
The sovereignty angle is subtle. The CMP script loads on every page view, so it sits in the path of all visitor traffic and sees IP addresses and device details before any consent has been given. If the script is served from outside the EU or the provider is subject to foreign jurisdiction, the compliance tool itself can become a transfer of personal data. Consent records are also your evidence in a dispute, so they must be retained, tamper-resistant and under your control.
When choosing a European option, check where the script and logs are served and stored, whether the banner works without external fonts or tracking of its own, how consent logs can be exported and how long they are kept. Also test that rejecting is as easy as accepting.